package com.jiyinit.web.core.common.interceptor;

import com.jiyinit.core.framework.base.entity.ResponseDto;
import com.jiyinit.core.framework.base.util.Check;
import com.jiyinit.web.core.common.constant.Constant;
import com.jiyinit.web.core.common.util.UserUtil;
import com.jiyinit.web.core.common.vo.CurrentUserVo;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.HashSet;
import java.util.Set;

/**
 * <p>权限拦截器</p>
 * <p>
 * <PRE>
 * <BR>	修改记录
 * <BR>-----------------------------------------------
 * <BR>	修改日期			修改人			修改内容
 * </PRE>
 *
 * @author lishaochuan
 * @version 1.0
 * @date 2017/4/10 17:37
 * @since 1.0
 */
public class AuthInterceptor extends HandlerInterceptorAdapter {


   /* @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        String contextPath = request.getContextPath();// contextPath=/web-core
        String servletPath = request.getServletPath();
        int index = -1;
        if ((index = servletPath.indexOf(".")) > -1) {
            servletPath = servletPath.substring(1, index);
        } else if ((index = servletPath.indexOf("?")) > -1) {
            servletPath = servletPath.substring(1, index);
        } else {
            servletPath = servletPath.substring(1);
        }
        String requestType = request.getHeader("X-Requested-With");
        ResponseDto dto = new ResponseDto();
        CurrentUserVo user = UserUtil.getCurrentUser();
        //当前登录用户为空 session失效
        if (Check.isNullObj(user)) {
            if ("XMLHttpRequest".equalsIgnoreCase(requestType)) {// AJAX REQUEST PROCESS
                response.setHeader("responseState", "timeout");
                dto.setStatus(ResponseDto.FAILED);
                dto.setMessage(servletPath + "登录超时！");
                response.getWriter().print(dto.toJsonString());
            } else {
                response.sendRedirect(contextPath + "/logout");
            }
            return false;
        }
        //当前用户url权限
        Set<String> resUrlSet = user.getUrlSet();
        if (Check.isNullCollection(resUrlSet) || !resUrlSet.contains(servletPath)) {
            if ("XMLHttpRequest".equalsIgnoreCase(requestType)) {// AJAX REQUEST PROCESS
                response.setHeader("responseState", "unauthorized");
                dto.setStatus(ResponseDto.FAILED);
                dto.setMessage(servletPath + "未设置权限！");
                response.getWriter().print(dto.toJsonString());
            } else {
                response.sendRedirect(contextPath + "/noAuthority");
            }
            return false;
        }
        return super.preHandle(request, response, handler);
    }*/

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        String contextPath = request.getContextPath();// contextPath=/web-core
        String servletPath = request.getServletPath();
        int index = -1;
        if ((index = servletPath.indexOf(".")) > -1) {
            servletPath = servletPath.substring(1, index);
        } else if ((index = servletPath.indexOf("?")) > -1) {
            servletPath = servletPath.substring(1, index);
        } else {
            servletPath = servletPath.substring(1);
        }
        ResponseDto dto = new ResponseDto();
        CurrentUserVo user = UserUtil.getCurrentUser();
        //当前登录用户为空 session失效
        if (Check.isNullObj(user)) {
            response.sendRedirect(contextPath + "/blank");
            return false;
        }
        // 无需拦截，直接放过
        if(servletPath.contains("/" + "anon" + "/")){
            return super.preHandle(request, response, handler);
        }
        //校验当前用户url权限
        Set<String> resUrlSet = user.getUrlSet();
        String requestType = request.getHeader("X-Requested-With");
        if (Check.isNullCollection(resUrlSet) || !resUrlSet.contains(servletPath)) {
            if ("XMLHttpRequest".equalsIgnoreCase(requestType)) {// AJAX REQUEST PROCESS
                response.setHeader("responseState", "unauthorized");
                dto.setStatus(ResponseDto.FAILED);
                dto.setMessage(servletPath + "未设置权限！");
                response.getWriter().print(dto.toJsonString());
            } else {
                response.sendRedirect(contextPath + "/noAuthority");
            }
            return false;
        }
        return super.preHandle(request, response, handler);
    }


}
